Android app protection policy settings in Microsoft Intune

This article describes the app protection policy settings for Android devices. The policy settings that are described can be configured for an app protection policy on the Settings blade in the Azure portal. There are three categories of policy settings: data protection settings, access requirements, and conditional launch. In this article, the term policy-managed apps refers to apps that are configured with app protection policies.

Important

The Intune Company Portal is required on the device to recieve App Protection Policies for Android devices. For more information, see the Intune Company Portal access apps requirements.

Data protection

Data Transfer

Setting How to use Default value
Backup Org data to Android backup services Select Block to prevent this app from backing up work or school data to the Android Backup Service.

Select Allow to allow this app to back up work or school data.
Allow
Send Org data to other apps Specify what apps can receive data from this app:
  • Policy managed apps: Allow transfer only to other policy-managed apps.
  • All apps: Allow transfer to any app.
  • None: Do not allow data transfer to any app, including other policy-managed apps.

There are some exempt apps and services to which Intune may allow data transfer by default. In addition, you can create your own exemptions if you need to allow data to transfer to an app that doesn't support Intune APP. For more information, see Data transfer exemptions.

This policy may also apply to Android App Links. General web links are managed by the Open app links in Intune Managed Browser policy setting.

Note

Intune doesn't currently support the Android Instant Apps feature. Intune will block any data connection to or from the app. For more information, see Android Instant Apps in the Android Developer documentation.

If Send Org data to other apps is configured to All apps, text data may still be transferred via OS sharing to the clipboard.

All apps
    Select apps to exempt
This option is available when you select Policy managed apps for the previous option.
Receive data from other apps Specify what apps can transfer data to this app:
  • Policy managed apps: Allow transfer only from other policy-managed apps.
  • All apps: Allow data transfer from any app.
  • None: Do not allow data transfer from any app, including other policy-managed apps.

There are some exempt apps and services from which Intune may allow data transfer. See Data transfer exemptions for a full list of apps and services.

All apps
Save copies of Org data Choose Block to disable the use of the Save As option in this app. Choose Allow if you want to allow the use of Save As. Note: This setting is supported for Microsoft Excel, OneNote, PowerPoint, and Word. It may also be supported by third-party and LOB apps. Allow
    Allow user to save copies to selected services
Users can save to the selected services (OneDrive for Business, SharePoint, and Local Storage). All other services will be blocked. 0 selected
Restrict cut, copy and paste between other apps Specify when cut, copy, and paste actions can be used with this app. Choose from:
  • Blocked: Do not allow cut, copy, and paste actions between this app and any other app.
  • Policy managed apps: Allow cut, copy, and paste actions between this app and other policy-managed apps.
  • Policy managed with paste in: Allow cut or copy between this app and other policy-managed apps. Allow data from any app to be pasted into this app.
  • Any app: No restrictions for cut, copy, and paste to and from this app.
Any app
    Cut and copy character limit for any app
Specify the number of characters that may be cut or copied from Org data and accounts. This will allow sharing of the specified number of characters to any application, regardless of the "Restrict cut, copy, and paste with other apps" setting.

Default Value = 0

Note: Requires Intune Company Portal version 5.0.4364.0 or later.

0
Screen capture and Google Assistant Select Disable to block screen capture and the Google Assistant capabilities of the device when using this app. Choosing Disable will also blur the App-switcher preview image when using this app with a work or school account. Enable
Org data notifications Specify how much Org data is shared via OS notifications for Org accounts. This policy setting will impact the local device and any connected devices such as wearables and smart speakers. Apps may provide additional controls to customize notification behavior or may choose to not honor all values. Select from:
  • Block: Do not share notifications.
    • If not supported by the application, notifications will be allowed.
  • Block Org Data: Do not share Org data in notifications. For example, "You have new mail"; "You have a meeting"
    • If not supported by the application, notifications will be blocked.
  • Allow: Shares Org data in the notifications
  • Any app: No restrictions for cut, copy, and paste to and from this app.

Note: This setting requires app support. At this time, Outlook for Android 4.75.0 or later will support this setting, which is expected to release the week of December 16th, 2019.

Allow

Encryption

Setting How to use Default value
Encrypt Org data Choose Require to enable encryption of work or school data in this app. Intune uses an OpenSSL, 256-bit AES encryption scheme along with the Android Keystore system to securely encrypt app data. Data is encrypted synchronously during file I/O tasks. Content on the device storage is always encrypted. New files will be encrypted with 256-bit keys. Existing 128-bit encrypted files will undergo a migration attempt to 256-bit keys, but the process is not guaranteed. Files encrypted with 128-bit keys will remain readable.

The encryption method is FIPS 140-2 validated; for more information, see OpenSSL FIPS Library and Android Guide.
Require
    Encrypt Org data on enrolled devices
Select Require to enforce encrypting Org data with Intune app layer encryption on all devices. Select Not required to not enforce encrypting Org data with Intune app layer encryption on enrolled devices. Require

Functionality

Setting How to use Default value
Sync app with native contacts app Choose Disable to prevent the app from saving data to the native Contacts app on the device. If you choose Enable, the app can save data to the native Contacts app on the device.

When you perform a selective wipe to remove work, or school data from the app, contacts synced directly from the app to the native Contacts app are removed. Any contacts synced from the native address book to another external source can't be wiped. Currently this applies only to the Microsoft Outlook app.
Enable
Printing Org data Choose Disable to prevent the app from printing work or school data. If you leave this setting to Enable, the default value, users will be able to export and print all Org data. Enable
Share web content with policy managed browsers Specify how web content (http/https links) are opened from policy-managed applications. Choose from:
  • Require: Allow web content to open only in policy-managed browsers.
  • Unmanaged browser: Allow web content to open only in the unmanaged browser defined by the Unmanaged browser ID setting. The web content will be unmanaged in the target browser.
    Note: Requires Intune Company Portal version 5.0.4415.0 or later.
  • Not configured: Allow web links in any app


If you're using Intune to manage your devices, see Manage Internet access using managed browser policies with Microsoft Intune.

Policy-managed browsers
If you deploy multiple policy-managed browsers, only one will be launched. The launch order will be Intune Managed Browser and then Microsoft Edge. On Android, your end users can choose from other policy-managed apps that support http/https links if neither Intune Managed Browser nor Microsoft Edge are installed.

If a policy-managed browser is required but not installed, your end users will be prompted to install the Intune Managed Browser.

If a policy-managed browser is required, Android App Links are managed by the Allow app to transfer data to other apps policy setting.

Intune device enrollment
If you are using Intune to manage your devices, see Manage Internet access using managed browser policies with Microsoft Intune.

Policy-managed Microsoft Edge
The Microsoft Edge browser for mobile devices (iOS and Android) supports Intune app protection policies. Users who sign in with their corporate Azure AD accounts in the Microsoft Edge browser application will be protected by Intune. The Microsoft Edge browser integrates the MAM SDK and supports all of its data protection policies, with the exception of preventing:

  • Save-as: The Microsoft Edge browser does not allow a user to add direct, in-app connections to cloud storage providers (such as OneDrive).
  • Contact sync: The Microsoft Edge browser does not save to native contact lists.

Note: The APP SDK cannot determine if a target app is a browser. On Android devices, other managed browser apps that support the http/https intent are allowed.
Not configured
    Unmanaged Browser ID
Enter the application ID for a single browser. Web content (http/https links) from policy managed applications will open in the specified browser. The web content will be unmanaged in the target browser. Blank
    Unmanaged Browser Name
Enter the application name for browser associated with the Unmanaged Browser ID. This name will be displayed to users if the specified browser is not installed. Blank

Data transfer exemptions

There are some exempt apps and platform services that Intune app protection policy may allow data transfer to and from. For example, all Intune-managed apps on Android must be able to transfer data to and from the Google Text-to-speech, so that text from your mobile device screen can be read aloud. This list is subject to change and reflects the services and apps considered useful for secure productivity.

Full exemptions

These apps and services are fully allowed for data transfer to and from Intune-managed apps.

App/service name Description
com.android.phone Native phone app
com.android.vending Google Play Store
com.android.documentsui Android Document Picker
com.google.android.webview WebView, which is necessary for many apps including Outlook.
com.android.webview Webview, which is necessary for many apps including Outlook.
com.google.android.tts Google Text-to-speech
com.android.providers.settings Android system settings
com.android.settings Android system settings
com.azure.authenticator Azure Authenticator app, which is required for successful authentication in many scenarios.
com.microsoft.windowsintune.companyportal Intune Company Portal

Conditional exemptions

These apps and services are only allowed for data transfer to and from Intune-managed apps under certain conditions.

App/service name Description Exemption condition
com.android.chrome Google Chrome Browser Chrome is used for some WebView components on Android 7.0+ and is never hidden from view. Data flow to and from the app, however, is always restricted.
com.skype.raider Skype The Skype app is allowed only for certain actions that result in a phone call.
com.android.providers.media Android media content provider The media content provider allowed only for the ringtone selection action.
com.google.android.gms; com.google.android.gsf Google Play Services packages These packages are allowed for Google Cloud Messaging actions, such as push notifications.
com.google.android.apps.maps Google Maps Addresses are allowed for navigation

For more information, see Data transfer policy exceptions for apps.

Access requirements

Setting How to use
Require PIN for access Select Yes to require a PIN to use this app. The user is prompted to set up this PIN the first time they run the app in a work or school context.

Default value = Yes.

Configure the following settings for PIN strength:
  • Select Type: Set a requirement for either numeric or passcode type PINs before accessing an app that has app protection policies applied. Numeric requirements involve only numbers, while a passcode can be defined with at least 1 alphabetical letter or at least 1 special character.

    Default value = Numeric

    Note: Special characters allowed include the special characters and symbols on the Android English language keyboard.
  • Allow simple PIN: Select Yes to allow users to use simple PIN sequences like 1234, 1111, abcd or aaaa. Select No to prevent them from using simple sequences. Simple sequences are checked in 3 character sliding windows. If No is configured, 1235 or 1112 would not be accepted as PIN set by the end user, but 1122 would be allowed.

    Default value = Yes

    Note: If Passcode type PIN is configured, and Allow simple PIN is set to Yes, the user needs at least one letter or at least one special character in their PIN. If Passcode type PIN is configured, and Allow simple PIN is set to No, the user needs at least one number and one letter and at least one special character in their PIN.

  • PIN length: Specify the minimum number of digits in a PIN sequence.

    Default value = 4

  • Allow fingerprint instead of PIN (Android 6.0+): Select Yes to allow the user to use fingerprint authentication instead of a PIN for app access.

    Default value = Yes

    Note: This feature supports generic controls for biometric on Android devices. OEM-specific biometric settings, like Samsung Pass, are not supported.

    On Android, you can let the user prove their identity by using Android fingerprint authentication instead of a PIN. When the user tries to use this app with their work or school account, they are prompted to provide their fingerprint identity instead of entering a PIN.

    Android work profile enrolled devices require registering a separate fingerprint for the Allow fingerprint instead of PIN policy to be enforced. This policy takes effect only for policy-managed apps installed in the Android work profile. The separate fingerprint must be registered with the device after the Android work profile is created by enrolling in the Company Portal. For more information about work profile fingerprints using Android work profiles, see Lock your work profile.

    • Override fingerprint with PIN after timeout: To use this setting, select Yes and then configure an inactivity timeout.

      Default value = Yes

    • Timeout (minutes of inactivity): Specify a time in minutes after which either a passcode or numeric (as configured) PIN will override the use of a fingerprint. This timeout value should be greater than the value specified under 'Recheck the access requirements after (minutes of inactivity)'.

      Default value = 30

  • Disable app PIN when device PIN is managed: Select Yes to disable the app PIN when a device lock is detected on an enrolled device with Company Portal configured.

    Default value = No.
Require corporate credentials for access Choose Yes to require the user to sign in with their work or school account instead of entering a PIN for app access. When set to Yes, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown.

Default value = No
Recheck the access requirements after (minutes) Configure the following setting:
  • Timeout: This is the number of minutes before the access requirements (defined earlier in the policy) are rechecked. For example, an admin turns on PIN and Blocks rooted devices in the policy, a user opens an Intune-managed app, must enter a PIN, and must be using the app on a non-rooted device. When using this setting, the user won't have to enter a PIN or undergo another root-detection check on any Intune-managed app for a period of time equal to the configured value.

    This policy setting format supports a positive whole number.

    Default value = 30 minutes

    Note: On Android, the PIN is shared with all Intune-managed apps. The PIN timer is reset once the app leaves the foreground on the device. The user won't have to enter a PIN on any Intune-managed app that shares its PIN for the duration of the timeout defined in this setting.

Block screen capture and Android Assistant Select Yes to block screen capture and the Android Assistant capabilities of the device when using this app. Choosing Yes will also blur the App-switcher preview image when using this app with a work or school account.

Default value = No

Note

To learn more about how multiple Intune app protection settings configured in the Access section to the same set of apps and users work on Android, see Intune MAM frequently asked questions and Selectively wipe data using app protection policy access actions in Intune.

Conditional launch

Configure conditional launch settings to set sign-in security requirements for your access protection policy.

By default, several settings are provided with pre-configured values and actions. You can delete some of settings, like the Min OS version. You can also select additional settings from the Select one dropdown.

Setting How to use
Max PIN attempts Specify the number of tries the user has to successfully enter their PIN before the configured action is taken. This policy setting format supports a positive whole number. Actions include:
  • Reset PIN - The user must reset their PIN.
  • Wipe data - The user account that is associated with the application is wiped from the device.
Default value = 5
Offline grace period The number of minutes that MAM apps can run offline. Specify the time (in minutes) before the access requirements for the app are rechecked. Actions include:
  • Block access (minutes) - The number of minutes that MAM apps can run offline. Specify the time (in minutes) before the access requirements for the app are rechecked. After this period expires, the app requires user authentication to Azure Active Directory (Azure AD) so that the app can continue to run.

    This policy setting format supports a positive whole number.

    Default value = 720 minutes (12 hours)
  • Wipe data (days) - After this many days (defined by the admin) of running offline, the app will require the user to connect to the network and reauthenticate. If the user successfully authenticates, they can continue to access their data and the offline interval will reset. If the user fails to authenticate, the app will perform a selective wipe of the users account and data. For more information, see How to wipe only corporate data from Intune-managed apps.
This policy setting format supports a positive whole number.

Default value = 90 days

This entry can appear multiple times, with each instance supporting a different action.
Jailbroken/rooted devices There is no value to set for this setting. Actions include:
  • Block access - Prevent this app from running on jailbroken or rooted devices. The user continues to be able to use this app for personal tasks, but will have to use a different device to access work or school data in this app.
  • Wipe data - The user account that is associated with the application is wiped from the device.
Min OS version Specify a minimum Android operating system that is required to use this app. Actions include:
  • Warn - The user will see a notification if the Android version on the device doesn't meet the requirement. This notification can be dismissed.
  • Block access - The user will be blocked from access if the Android version on the device doesn't meet this requirement.
  • Wipe data - The user account that is associated with the application is wiped from the device.
This policy setting format supports either major.minor, major.minor.build, major.minor.build.revision.
Min app version Specify a value for the minimum operating system value. Actions include:
  • Warn - The user sees a notification if the app version on the device doesn't meet the requirement. This notification can be dismissed.
  • Block access - The user is blocked from access if the app version on the device does not meet the requirement.
  • Wipe data - The user account that is associated with the application is wiped from the device.
As apps often have distinct versioning schemes between them, create a policy with one minimum app version targeting one app (for example, Outlook version policy).

This entry can appear multiple times, with each instance supporting a different action.

This policy setting format supports either major.minor, major.minor.build, major.minor.build.revision.

Additionally, you can configure where your end users can get an updated version of a line-of-business (LOB) app. End users will see this in the min app version conditional launch dialog, which will prompt end users to update to a minimum version of the LOB app. On Android, this feature uses the Company Portal. To configure where an end user should update a LOB app, the app needs a managed app configuration policy sent to it with the key, com.microsoft.intune.myappstore. The value sent will define which store the end user will download the app from. If the app is deployed via the Company Portal, the value must be CompanyPortal. For any other store, you must enter a complete URL.
Min patch version Require devices have a minimum Android security patch released by Google.
  • Warn - The user will see a notification if the Android version on the device doesn't meet the requirement. This notification can be dismissed.
  • Block access - The user will be blocked from access if the Android version on the device doesn't meet this requirement.
  • Wipe data - The user account that is associated with the application is wiped from the device.
This policy setting supports the date format of YYYY-MM-DD.
Device manufacturer(s) Specify a semi-colon separated list of manufacturer(s). These values are not case sensitive. Actions include:
  • Allow specified (Block non-specified) - Only devices that match the specified manufacturer can use the app. All other devices are blocked.
  • Allow specified (Wipe non-specified) - The user account that is associated with the application is wiped from the device.
For more information on using this setting, see Conditional Launch actions.
SafetyNet device attestation App protection policies support some of Google Play Protect's APIs. This setting in particular configures Google's SafetyNet Attestation on end user devices. Specify either Basic integrity or Basic integrity and certified devices. Basic integrity tells you about the general integrity of the device. Rooted devices, emulators, virtual devices, and devices with signs of tampering fail basic integrity. Basic integrity & certified devices tells you about the compatibility of the device with Google's services. Only unmodified devices that have been certified by Google can pass this check. Actions include:
  • Warn - The user sees a notification if the device does not meet Google's SafetyNet Attestation scan based on the value configured. This notification can be dismissed.
  • Block access - The user is blocked from access if the device does not meet Google's SafetyNet Attestation scan based on the value configured.
  • Wipe data - The user account that is associated with the application is wiped from the device.
For commonly asked questions related to this setting, see Frequently asked questions about MAM and app protection.
Require threat scan on apps App protection policies support some of Google Play Protect's APIs. This setting in particular ensures that Google's Verify Apps scan is turned on for end user devices. If configured, the end user will be blocked from access until they turn on Google's app scanning on their Android device. Actions include:
  • Warn - The user sees a notification if Google's Verify Apps scan on the device is not turned on. This notification can be dismissed.
  • Block access - The user is blocked from access if Google's Verify Apps scan on the device is not turned on.
Results from Google's Verify Apps scan are surfaced in the Potentially Harmful Apps report in the console.
Min Company Portal version By using the Min Company Portal version, you can specify a specific minimum defined version of the Company Portal that is enforced on an end user device. This conditional launch setting allows you to set values to Block access, Wipe data, and Warn as possible actions when each value is not met. The possible formats for this value follows the pattern [Major].[Minor], [Major].[Minor].[Build], or [Major].[Minor].[Build].[Revision]. Given that some end users may not prefer a forced update of apps on the spot, the 'warn' option may be ideal when configuring this setting. The Google Play Store does a good job of only sending the delta bytes for app updates, but this can still be a large amount of data that the user may not want to utilize if they are on data at the time of the update. Forcing an update and thereby downloading an updated app could result in unexpected data charges at the time of the update. For more information, see Android policy settings.
Max allowed device threat level App protection policies can take advantage of the Intune-MTD connector. Specify a maximum threat level acceptable to use this app. Threats are determined by your chosen Mobile Threat Defense (MTD) vendor app on the end user device. Specify either Secured, Low, Medium, or High. Secured requires no threats on the device and is the most restrictive configurable value, while High essentially requires an active Intune-to-MTD connection. Actions include:
  • Block access - The user will be blocked from access if the threat level determined by your chosen Mobile Threat Defense (MTD) vendor app on the end user device doesn't meet this requirement.
  • Wipe data - The user account that is associated with the application is wiped from the device.
For more information on using this setting, see Enable the Mobile Threat Defense connector in Intune for unenrolled devices.